Port 3389: Remote Desktop (RDP)

What is port 3389 used for?

Windows Remote Desktop Protocol.

Should port 3389 be open?

Don’t expose to the internet. Keep this port on private networks and reach it through a VPN or SSH tunnel. RDP on the internet is a common ransomware entry point. Use a VPN or a gateway, enable Network Level Authentication and lock accounts after failed logins.

See what is listening on port 3389

# Linux
sudo ss -tlnp | grep ':3389 '

# macOS
sudo lsof -nP -i TCP:3389 -sTCP:LISTEN

# Windows (PowerShell)
Get-NetTCPConnection -LocalPort 3389 -State Listen

Open or block port 3389 in a firewall

# Ubuntu / Debian (ufw)
sudo ufw allow 3389/tcp
sudo ufw deny 3389/tcp

# Windows (PowerShell, as administrator)
New-NetFirewallRule -DisplayName "Port 3389" -Direction Inbound -Protocol TCP -LocalPort 3389 -Action Allow

On cloud servers, also open the port in the provider’s security group or network firewall. At home, a service behind a router needs a port-forwarding rule to the device’s local IP.

Test it from outside

A port can be open on the server but blocked upstream. The Port Checker connects from the internet, so it shows what the world sees. From your own machine, use nc -vz example.com 3389 (macOS/Linux) or Test-NetConnection example.com -Port 3389 (Windows).